Skewness in indicators of compromise

1. A computer-implemented method of detecting a statistically-significant security event and automating a response thereto, comprising:

querying, or causing to be queried, a security intelligence database for sector-wise historical norms for an indicator of compromise (IoC);

obtaining sector-wise expected prevalence data for the IoC;

receiving observed sector-wise prevalence data for the IoC;

computing a first test statistic from a goodness-of-fit test between the observed and expected prevalence data;

from the observed sector-wise prevalence data, computing a second test statistic from a difference between a highest prevalence and a next-highest prevalence;

computing a third test statistic from a difference between the observed prevalence data of a highest prevalence sector and the expected prevalence data for the highest prevalence sector;

selecting a least significant statistic from among the first, second, and third test statistics;

determining from the least significant statistic whether to notify a subscriber; and

taking a security action responsive to the determining.

2. The computer-implemented method of claim 1 , further comprising receiving a user-selected criterion from the subscriber, and notifying the subscriber only if the least significant statistic meets the user-selected criterion.

3. The computer-implemented method of claim 2 , wherein the user-selected criterion comprises a maximum p-value threshold.

4. The computer-implemented method of claim 2 , wherein the user-selected criterion comprises a minimum statistical significance.

5. The computer-implemented method of claim 1 , wherein sector-wise prevalence data are computed on a sector type, the sector type selected from the group consisting of industry, geographic, enterprise or business type, profit model, government-or-private, internal business unit, religious group, ethnic group, operating system, and user groups.

6. A skewness analyzer, comprising:

a hardware platform; and

a skewness analysis engine to execute on the hardware platform, and configured to:

receive historical prevalences for an indicator of compromise (IoC) across a plurality of sectors;

receive observed prevalences for the IoC across the sectors;

calculate a composite goodness-of-fit between the historical prevalences and observed prevalences to provide a first p-value;

from the observed prevalences, calculate a two-proportions statistic between a highest prevalence sector and a next-highest-prevalence sector to provide a second p-value;

compute a two-proportions statistic between the observed prevalence and an expected prevalence, based on the historical prevalences, for the highest prevalence sector to provide a third p-value;

select a final p-value being the least significant of the three provided p-values;

query a subscriber database for a subscriber identifier and notification criterion; and

if the final p-value meets the notification criterion, notify a subscriber of a security event associated with the final p-value, and instruct the subscriber to take a security action.

7. The skewness analyzer of claim 6 , wherein the historical prevalences are derived from a sliding historical window.

8. The skewness analyzer of claim 7 , wherein the sliding historical window is biased toward recent historical data.

9. The skewness analyzer of claim 6 , wherein the observed prevalences are selected from a sliding window of recent short-term data.

10. The skewness analyzer of claim 6 , wherein calculating a composite goodness-of-fit further comprises applying a chi-square test.

11. The skewness analyzer of claim 6 , wherein at least one of the second and third p-values is computed as a statistical test of two proportions.

12. The skewness analyzer of claim 6 , wherein notifying the subscriber comprises determining whether the least significant p-value is statistically significant.

13. The skewness analyzer of claim 6 , wherein the notification criterion is a user-selected maximum p-value threshold.

14. The skewness analyzer of claim 6 , wherein the skewness analysis engine is further to initiate a self-healing process.

15. The skewness analyzer of claim 6 , wherein the skewness analysis engine is further to initiate an investigation of the IoC.

16. The skewness analyzer of claim 6 , wherein the skewness analysis engine is further to send electronic instructions to automatically elevate security for devices or users affected by the IoC.

17. The skewness analyzer of claim 6 , wherein the skewness analysis engine is further to automatically quarantine users or devices affected by the IoC.

18. One or more tangible, non-transitory computer-readable media having stored thereon executable instructions to:

query a database for historical prevalences for a plurality of sectors and an indicator of compromise (IoC);

receive updated prevalences for the plurality of sectors and the IoC;

compute expected prevalences for the plurality of sectors and the IoC;

compute a plurality of statistical p-values from the historical prevalences, the updated prevalences, and the expected prevalences, the plurality of statistical p-values including at least a goodness-of-fit and a two-proportions test;

select a largest magnitude p-value from the plurality of statistical p-values; and

perform a network security action according to the largest magnitude p-value.

19. The one or more tangible, non-transitory computer-readable media of claim 18 , wherein the instructions are further to apply a chi-square analysis to test a difference between the expected prevalences and observed prevalences to derive a goodness-of-fit.

20. The one or more tangible, non-transitory computer-readable media of claim 18 , wherein the instructions are further to determine whether to notify a subscriber, further comprising determining whether the largest magnitude p-value is statistically significant.